SSO Confusion for Users with Impersonate options on origin platform

Do you have some sort of way of telling in the origin that a user is “impersonated” vs “really the user”?

If so the simplest thing here is to just have your SSO endpoint explode for impersonated cases.